The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute ffmpeg, ffprobe, and tesseract for video and audio analysis. These calls are implemented using list-based arguments without the shell=True flag, which is a secure practice that prevents shell injection vulnerabilities. The use of these binaries is consistent with the skill's stated purpose.\n- [EXTERNAL_DOWNLOADS]: Dependencies such as reportlab, pypdf, and timecode are strictly version-pinned within the script metadata (PEP 723). The doctor.py diagnostic script verifies these pins and the availability of required system binaries. No arbitrary remote script execution or unverified downloads were found.\n- [DATA_EXFILTRATION]: File operations are confined to reading local input media and writing structured reports (JSON, Markdown, PDF). There is no evidence of unauthorized access to sensitive user data, environment variables, or credential stores. No network exfiltration vectors or suspicious outbound calls are present.\n- [PROMPT_INJECTION]: The skill ingests OCR text from video frames to populate report labels. This external data is handled as descriptive metadata and is escaped when rendered in Markdown tables, minimizing the risk of indirect prompt injection targeting the agent's context.

program-master